Microsoft

CVE-2026-88092: ASP.NET Core Tampering Vulnerability

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of 29 Oct 2026. If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?

0.9%

Up from 0.8% on 22 Oct 2026.

EPSS score, percentile 60.7 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

9.4 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

from 10.0 to before 10.0.13
from 11.0 to before 11.0.0-rc.2
from 8.0 to before 8.0.32
from 9.0 to before 9.0.21
from 17.14.0 to before 17.14.42
from 18.10.0 to before 18.10.4

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; FIRST EPSS, as of 29 Oct 2026; CVE List, as of 29 Oct 2026. About the data.

What to do

Advisories and patches

ASP.NET Core Tampering Vulnerability (Vendor advisory, Patch)

This summary is based on the CVE record as of 29 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

As listed in the CVE record.

Microsoft ASP.NET Core 10.0
Status	Versions
Affected	from 10.0 to before 10.0.13

Microsoft ASP.NET Core 11.0
Status	Versions
Affected	from 11.0 to before 11.0.0-rc.2

Microsoft ASP.NET Core 8.0
Status	Versions
Affected	from 8.0 to before 8.0.32

Microsoft ASP.NET Core 9.0
Status	Versions
Affected	from 9.0 to before 9.0.21

Microsoft Microsoft Visual Studio 2022 version 17.14
Status	Versions
Affected	from 17.14.0 to before 17.14.42

Microsoft Microsoft Visual Studio 2026 version 18.10
Status	Versions
Affected	from 18.10.0 to before 18.10.4

Source: CVE List, as of 29 Oct 2026. About the data.

About this vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Summary: CVE record, as of 29 Oct 2026.

CISA has not added CVE-2026-88092 to its Known Exploited Vulnerabilities (KEV) catalog, as of 29 Oct 2026.
The CVE record was published on 13 Oct 2026.
The CVE record carries a CVSS v3.1 base score of 9.4 (Critical), given by its CNA.
FIRST's EPSS model puts the probability of exploitation in the next 30 days at 0.9% (percentile 60.7), as of 29 Oct 2026. EPSS is a statistical estimate, not a report of exploitation.
CISA's SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; CVE List, as of 29 Oct 2026; FIRST EPSS, as of 29 Oct 2026. About the data.

Description

ASP.NET Core Tampering Vulnerability

Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering over a network.

Source: CVE List, as of 29 Oct 2026. About the data.

Weakness

CWE-444

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

Date	Event
13 Oct 2026	CVE record published
28 Oct 2026	CVE record last updated

Known exploited Microsoft vulnerabilities

CVE-2026-96951: Microsoft Windows Command Injection Vulnerability (added 13 Oct 2026)
CVE-2026-65660: Microsoft SharePoint Code Injection Vulnerability (added 25 Sep 2026)
CVE-2026-81963: Microsoft Windows Link Following Vulnerability (added 8 Sep 2026)
CVE-2026-85880: Microsoft Windows Heap-Based Buffer Overflow Vulnerability (added 8 Sep 2026)
CVE-2019-1068: Microsoft SQL Server Remote Code Execution Vulnerability (added 26 Aug 2026)